feat: add web upload for EML/MBOX files #260

crates/cli/src/mbox/mod.rs

@@ -21,7 +21,7 @@ use std::path::PathBuf;
 
 use crate::api::sender::send_batch_request;
 use crate::mbox::gmail::determine_folder;
-use crate::mbox::reader::MboxFile;
+use bichon_core::import::reader::MboxFile;
 use crate::BichonCliConfig;
 use bichon_core::base64_encode_url_safe;
 use bichon_core::envelope::meta::{parse_bichon_metadata, BichonMetadata};
@@ -37,7 +37,6 @@ const MAX_EMAIL_BYTES: usize = 100 * 1024 * 1024;
 const MAX_BUFFER_BYTES: usize = 200 * 1024 * 1024;
 
 pub mod gmail;
-pub mod reader;
 
 pub async fn handle_mbox_single_file_import(
     config: &BichonCliConfig,

crates/core/Cargo.toml

@@ -72,3 +72,4 @@ scopeguard = "1.2.0"
 cron = "0.15"
 quick-xml = { version = "0.40.0", features = ["serialize"] }
 hickory-resolver = "0.26.0-alpha.1"
+memmap2 = "0.9.10"

crates/core/src/import/history.rs

@@ -0,0 +1,127 @@
+//
+// Copyright (c) 2025-2026 rustmailer.com (https://rustmailer.com)
+//
+// This file is part of the Bichon Email Archiving Project
+
+use crate::database::MemDbModel;
+use crate::import::{ImportProgress, ImportStatus};
+use serde::{Deserialize, Serialize};
+
+/// Maximum number of import history entries to keep per user.
+pub const MAX_HISTORY_PER_USER: usize = 5;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[cfg_attr(feature = "web-api", derive(poem_openapi::Object))]
+pub struct ImportHistory {
+    /// Composite key: "{user_id}:{import_id}"
+    pub id: String,
+    pub user_id: u64,
+    pub import_id: String,
+    pub account_id: u64,
+    pub folder: String,
+    pub format: String,
+    pub status: String,
+    pub total: usize,
+    pub success: usize,
+    pub duplicates: usize,
+    pub failed: usize,
+    pub failed_details: Vec<crate::import::FailedItemDetail>,
+    /// Unix timestamp in milliseconds.
+    pub created_at: i64,
+}
+
+impl MemDbModel for ImportHistory {
+    fn collection() -> &'static str {
+        "import_history"
+    }
+    fn key(&self) -> String {
+        self.id.clone()
+    }
+}
+
+impl ImportHistory {
+    pub fn from_progress(
+        user_id: u64,
+        import_id: &str,
+        account_id: u64,
+        folder: &str,
+        progress: &ImportProgress,
+    ) -> Self {
+        Self {
+            id: format!("{}:{}", user_id, import_id),
+            user_id,
+            import_id: import_id.to_string(),
+            account_id,
+            folder: folder.to_string(),
+            format: progress.format.clone(),
+            status: match progress.status {
+                ImportStatus::Pending => "pending",
+                ImportStatus::Processing => "processing",
+                ImportStatus::Completed => "completed",
+                ImportStatus::Failed => "failed",
+            }
+            .to_string(),
+            total: progress.total,
+            success: progress.success,
+            duplicates: progress.duplicates,
+            failed: progress.failed,
+            failed_details: progress.failed_details.clone(),
+            created_at: crate::utc_now!(),
+        }
+    }
+}
+
+/// Prune old entries for a user so only the latest `MAX_HISTORY_PER_USER` remain.
+pub fn prune_user_history(user_id: u64) -> crate::error::BichonResult<()> {
+    use crate::database::manager::DB_MANAGER;
+    use crate::database::batch_delete_impl;
+    use crate::raise_error;
+    use crate::error::code::ErrorCode;
+    let db = DB_MANAGER.db();
+    let coll = db.collection(ImportHistory::collection());
+    let prefix = format!("{}:", user_id);
+
+    let mut entries: Vec<ImportHistory> = coll
+        .scan_prefix(&prefix)
+        .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+    if entries.len() <= MAX_HISTORY_PER_USER {
+        return Ok(());
+    }
+
+    // Sort by created_at descending (newest first), keep the first N
+    entries.sort_by(|a, b| b.created_at.cmp(&a.created_at));
+    let to_delete: Vec<String> = entries
+        .iter()
+        .skip(MAX_HISTORY_PER_USER)
+        .map(|e| e.id.clone())
+        .collect();
+
+    if !to_delete.is_empty() {
+        batch_delete_impl::<ImportHistory>(db, to_delete)?;
+    }
+
+    Ok(())
+}
+
+/// Save an import history record and prune old entries for the user.
+pub fn save_import_history(
+    user_id: u64,
+    account_id: u64,
+    folder: &str,
+    progress: &ImportProgress,
+) {
+    use crate::database::manager::DB_MANAGER;
+    use crate::database::upsert_impl;
+
+    let entry = ImportHistory::from_progress(user_id, &progress.import_id, account_id, folder, progress);
+    let db = DB_MANAGER.db();
+
+    if let Err(e) = upsert_impl::<ImportHistory>(db, entry) {
+        tracing::error!("Failed to save import history: {:?}", e);
+        return;
+    }
+
+    if let Err(e) = prune_user_history(user_id) {
+        tracing::warn!("Failed to prune import history: {:?}", e);
+    }
+}

crates/core/src/import/mod.rs

@@ -18,7 +18,15 @@
 
 
 //use poem_openapi::Object;
+pub mod history;
+pub mod reader;
+pub use history::ImportHistory;
 use serde::{Deserialize, Serialize};
+use std::{
+    collections::HashMap,
+    path::Path,
+    sync::RwLock,
+};
 
 use crate::{
     base64_decode_url_safe,
@@ -27,15 +35,20 @@ use crate::{
         cache::imap::mailbox::{Attribute, AttributeEnum, MailBox},
         envelope::extractor::extract_envelope_from_eml,
         error::{BichonResult, code::ErrorCode},
+        settings::dir::DATA_DIR_MANAGER,
         utils::create_hash,
     },
     raise_error,
 };
 
-/// Skip individual emails larger than this after decoding (100 MB).
+/// Maximum byte size of an individual email message after splitting (100 MB).
 const MAX_SINGLE_EML_BYTES: usize = 100 * 1024 * 1024;
 
-#[derive(Debug, Clone, Default, Eq, PartialEq, Serialize, Deserialize)]
+/// Max file size accepted via the web upload endpoint.
+pub const MAX_WEB_EML_BYTES: usize = 100 * 1024 * 1024;       // 100 MB
+pub const MAX_WEB_MBOX_BYTES: usize = 1024 * 1024 * 1024;     // 1 GB
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[cfg_attr(feature = "web-api", derive(poem_openapi::Object))]
 pub struct BatchEmlRequest {
     pub account_id: u64,
@@ -46,24 +59,26 @@ pub struct BatchEmlRequest {
 
 #[derive(Debug, Clone, Default, Eq, PartialEq, Serialize, Deserialize)]
 #[cfg_attr(feature = "web-api", derive(poem_openapi::Object))]
-pub struct FailedEmlDetail {
-    /// The 0-based index of the failed EML in the request list
+pub struct FailedItemDetail {
+    /// The index (0-based) of the failed item.
     pub index: usize,
-    /// The error message that caused the import to fail
+    /// The error message that caused the import to fail.
     pub error_message: String,
 }
 
 #[derive(Debug, Clone, Default, Eq, PartialEq, Serialize, Deserialize)]
 #[cfg_attr(feature = "web-api", derive(poem_openapi::Object))]
 pub struct BatchEmlResult {
-    /// Total number of emails processed
+    /// Total number of emails processed.
     pub total: usize,
-    /// Number of emails successfully imported
+    /// Number of emails successfully imported.
     pub success: usize,
-    /// Number of emails failed to import
+    /// Number of duplicate emails skipped (content hash already existed).
+    pub duplicates: usize,
+    /// Number of emails failed to import.
     pub failed: usize,
-    /// A list of details for failed imports
-    pub failed_details: Vec<FailedEmlDetail>,
+    /// A list of details for failed imports.
+    pub failed_details: Vec<FailedItemDetail>,
 }
 
 pub struct ImportEmls;
@@ -116,7 +131,7 @@ impl ImportEmls {
 
         let account_id = account.id;
         let mut success_count = 0;
-        let mut failed_details: Vec<FailedEmlDetail> = Vec::new(); // Store failure details
+        let mut failed_details: Vec<FailedItemDetail> = Vec::new(); // Store failure details
 
         let total = request.emls.len();
         let mut index: usize = 0;
@@ -127,7 +142,7 @@ impl ImportEmls {
                     let error_msg =
                         format!("Failed to decode base64 EML at index {}: {:?}", index, e);
                     tracing::error!("{}", error_msg);
-                    failed_details.push(FailedEmlDetail {
+                    failed_details.push(FailedItemDetail {
                         index,
                         error_message: error_msg,
                     });
@@ -144,7 +159,7 @@ impl ImportEmls {
                     index, size_mb,
                 );
                 tracing::warn!("{}", error_msg);
-                failed_details.push(FailedEmlDetail {
+                failed_details.push(FailedItemDetail {
                     index,
                     error_message: error_msg,
                 });
@@ -162,7 +177,7 @@ impl ImportEmls {
                         index, e
                     );
                     tracing::error!("{}", error_msg);
-                    failed_details.push(FailedEmlDetail {
+                    failed_details.push(FailedItemDetail {
                         index,
                         error_message: error_msg,
                     });
@@ -178,8 +193,529 @@ impl ImportEmls {
         Ok(BatchEmlResult {
             total,
             success: success_count,
+            duplicates: 0,
             failed: failed_count,
             failed_details, // Return the list of failure details
         })
     }
 }
+
+// ── File upload import ──────────────────────────────────────────────
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[cfg_attr(feature = "web-api", derive(poem_openapi::Enum))]
+pub enum ImportStatus {
+    Pending,
+    Processing,
+    Completed,
+    Failed,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[cfg_attr(feature = "web-api", derive(poem_openapi::Object))]
+pub struct ImportProgress {
+    pub import_id: String,
+    pub status: ImportStatus,
+    pub format: String,
+    pub total: usize,
+    pub success: usize,
+    pub duplicates: usize,
+    pub failed: usize,
+    pub failed_details: Vec<FailedItemDetail>,
+}
+
+static PROGRESS_STORE: std::sync::LazyLock<RwLock<HashMap<String, ImportProgress>>> =
+    std::sync::LazyLock::new(|| RwLock::new(HashMap::new()));
+
+pub fn get_import_progress(import_id: &str) -> Option<ImportProgress> {
+    PROGRESS_STORE.read().ok()?.get(import_id).cloned()
+}
+
+pub fn update_progress(import_id: &str, progress: ImportProgress) {
+    if let Ok(mut store) = PROGRESS_STORE.write() {
+        store.insert(import_id.to_string(), progress);
+    }
+}
+
+/// Check free disk space (in bytes) on the temp directory's filesystem.
+pub fn check_temp_disk_space() -> BichonResult<u64> {
+    use sysinfo::Disks;
+    let disks = Disks::new_with_refreshed_list();
+    let temp_path = &DATA_DIR_MANAGER.temp_dir;
+    // Use the canonical path so we can match mount points
+    let canonical = std::fs::canonicalize(temp_path).unwrap_or_else(|_| temp_path.clone());
+    for disk in disks.list() {
+        if canonical.starts_with(disk.mount_point()) {
+            return Ok(disk.available_space());
+        }
+    }
+    // Fallback: if we can't find the mount point, report plenty of space
+    Ok(u64::MAX)
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FileFormat {
+    Eml,
+    Mbox,
+}
+
+pub fn detect_format(bytes: &[u8], file_name: &str) -> Option<FileFormat> {
+    // MBOX files start with "From " (note the trailing space after From)
+    if bytes.starts_with(b"From ") {
+        // Double-check: look for a valid date after the first "From " line
+        // MBOX format: "From sender@host DayOfWeek Mon DD HH:MM:SS YYYY"
+        if let Some(first_newline) = bytes.iter().position(|&b| b == b'\n') {
+            let from_line = std::str::from_utf8(&bytes[..first_newline]).unwrap_or("");
+            let parts: Vec<&str> = from_line.split_whitespace().collect();
+            if parts.len() >= 7 {
+                return Some(FileFormat::Mbox);
+            }
+        }
+    }
+    // EML: starts with a header line or "Return-Path:", "Received:", "From:", "Date:", etc.
+    // Or check extension
+    if bytes.starts_with(b"Return-Path:")
+        || bytes.starts_with(b"Received:")
+        || bytes.starts_with(b"Date:")
+        || bytes.starts_with(b"From:")
+        || bytes.starts_with(b"Subject:")
+        || bytes.starts_with(b"To:")
+        || bytes.starts_with(b"Message-ID:")
+    {
+        return Some(FileFormat::Eml);
+    }
+    // Fallback: check file extension
+    let lower = file_name.to_lowercase();
+    if lower.ends_with(".eml") {
+        Some(FileFormat::Eml)
+    } else if lower.ends_with(".mbox") {
+        Some(FileFormat::Mbox)
+    } else {
+        None
+    }
+}
+
+/// Check whether `bytes` looks like a text file by inspecting the first chunk.
+/// Returns `true` if it passes, `false` if it appears to be binary (video, executable, etc.).
+///
+/// Email files (EML/MBOX) are text-based with printable ASCII, whitespace, and
+/// optional UTF-8. Binary files like video contain null bytes and high ratios of
+/// non-printable control characters.
+pub fn detect_text_file(bytes: &[u8]) -> bool {
+    let check_len = bytes.len().min(8192);
+    if check_len == 0 {
+        return false;
+    }
+    let sample = &bytes[..check_len];
+
+    // Null bytes are a strong binary indicator
+    if sample.contains(&0x00) {
+        return false;
+    }
+
+    let mut printable = 0usize;
+    let mut total = 0usize;
+
+    let mut i = 0;
+    while i < sample.len() {
+        total += 1;
+        let b = sample[i];
+
+        if b.is_ascii_graphic() || b.is_ascii_whitespace() {
+            // Printable ASCII + whitespace (space, tab, CR, LF)
+            printable += 1;
+        } else if b == 0x1b {
+            // ESC — common in terminal sequences, rare in email
+            // Count as printable to avoid false positives
+            printable += 1;
+        } else if b >= 0x80 {
+            // UTF-8 continuation or multi-byte lead byte — allow.
+            // Check that we have a valid UTF-8 sequence ahead.
+            let seq_len = match b {
+                b if b & 0xE0 == 0xC0 => 2,
+                b if b & 0xF0 == 0xE0 => 3,
+                b if b & 0xF8 == 0xF0 => 4,
+                _ => 0,
+            };
+            if seq_len > 0 && i + seq_len <= sample.len() {
+                let valid = std::str::from_utf8(&sample[i..i + seq_len]).is_ok();
+                if valid {
+                    printable += 1;
+                    i += 1; // lead byte counted, continuations counted in loop
+                }
+                // if invalid, don't count as printable
+            }
+            // standalone continuation byte — not printable
+        }
+        // Other control characters (0x01-0x1F except whitespace/Esc) are not counted as printable
+
+        i += 1;
+    }
+
+    // Require at least 90% printable characters
+    printable as f64 / total as f64 >= 0.90
+}
+
+/// Validate that the target account exists, is enabled, and is NoSync type.
+fn validate_import_account(account_id: u64) -> BichonResult<AccountModel> {
+    let account = AccountModel::check_account_exists(account_id)?;
+    if !account.enabled {
+        return Err(raise_error!(
+            "The account is disabled.".into(),
+            ErrorCode::InvalidParameter
+        ));
+    }
+    if !matches!(account.account_type, AccountType::NoSync) {
+        return Err(raise_error!(
+            "Import is only allowed for NoSync accounts. IMAP accounts sync from the server.".into(),
+            ErrorCode::InvalidParameter
+        ));
+    }
+    Ok(account)
+}
+
+/// Resolve or create a mailbox/folder for the given account.
+fn resolve_mailbox(account: &AccountModel, folder: &str) -> BichonResult<u64> {
+    match account.account_type {
+        AccountType::IMAP => {
+            // Shouldn't reach here (validated above), but handle gracefully
+            let all_mailboxes = MailBox::list_all(account.id)?;
+            let mailbox = all_mailboxes.into_iter().find(|m| m.name == folder);
+            match mailbox {
+                Some(m) => Ok(m.id),
+                None => Err(raise_error!(
+                    format!("Mail folder '{}' not found.", folder).into(),
+                    ErrorCode::ResourceNotFound
+                )),
+            }
+        }
+        AccountType::NoSync => {
+            let mailbox = MailBox {
+                id: create_hash(account.id, folder),
+                account_id: account.id,
+                name: folder.to_string(),
+                delimiter: Some("/".to_string()),
+                attributes: vec![Attribute {
+                    attr: AttributeEnum::Extension,
+                    extension: Some("CreatedByBichon".into()),
+                }],
+                exists: 0,
+                unseen: None,
+                uid_next: None,
+                uid_validity: None,
+                highest_uid: None,
+            };
+            let mailbox_id = mailbox.id;
+            MailBox::batch_upsert(&[mailbox])?;
+            Ok(mailbox_id)
+        }
+    }
+}
+
+/// Process an uploaded file (EML or MBOX) and import into the given account/folder.
+/// This runs synchronously and should be spawned on a background thread.
+///
+/// For MBOX files, the file is memory-mapped via `memmap2` and messages are yielded
+/// one at a time — the full file is never loaded into RAM. Individual messages
+/// exceeding `MAX_SINGLE_EML_BYTES` (100 MB) are skipped.
+pub fn process_uploaded_file(
+    import_id: &str,
+    file_path: &Path,
+    file_name: &str,
+    account_id: u64,
+    folder: &str,
+    user_id: u64,
+) {
+    let account = match validate_import_account(account_id) {
+        Ok(a) => a,
+        Err(e) => {
+            let progress = ImportProgress {
+                import_id: import_id.to_string(),
+                status: ImportStatus::Failed,
+                format: "unknown".to_string(),
+                total: 0,
+                success: 0,
+                duplicates: 0,
+                failed: 0,
+                failed_details: vec![FailedItemDetail {
+                    index: 0,
+                    error_message: format!("Account validation failed: {:?}", e),
+                }],
+            };
+            update_progress(import_id, progress.clone());
+            history::save_import_history(user_id, account_id, folder, &progress);
+            return;
+        }
+    };
+
+    let mailbox_id = match resolve_mailbox(&account, folder) {
+        Ok(id) => id,
+        Err(e) => {
+            let progress = ImportProgress {
+                import_id: import_id.to_string(),
+                status: ImportStatus::Failed,
+                format: "unknown".to_string(),
+                total: 0,
+                success: 0,
+                duplicates: 0,
+                failed: 0,
+                failed_details: vec![FailedItemDetail {
+                    index: 0,
+                    error_message: format!("Mailbox resolution failed: {:?}", e),
+                }],
+            };
+            update_progress(import_id, progress.clone());
+            history::save_import_history(user_id, account_id, folder, &progress);
+            return;
+        }
+    };
+
+    // Read a small prefix for format detection
+    let format = match detect_format_from_file(file_path, file_name) {
+        Ok(f) => f,
+        Err(e) => {
+            let progress = ImportProgress {
+                import_id: import_id.to_string(),
+                status: ImportStatus::Failed,
+                format: "unknown".to_string(),
+                total: 0,
+                success: 0,
+                duplicates: 0,
+                failed: 0,
+                failed_details: vec![FailedItemDetail {
+                    index: 0,
+                    error_message: format!("{:?}", e),
+                }],
+            };
+            update_progress(import_id, progress.clone());
+            history::save_import_history(user_id, account_id, folder, &progress);
+            let _ = std::fs::remove_file(file_path);
+            return;
+        }
+    };
+
+    match format {
+        FileFormat::Eml => process_eml_file(import_id, file_path, account_id, mailbox_id, user_id, folder),
+        FileFormat::Mbox => process_mbox_file(import_id, file_path, account_id, mailbox_id, user_id, folder),
+    }
+}
+
+/// Detect format from a file by reading only the first few KB.
+fn detect_format_from_file(file_path: &Path, file_name: &str) -> BichonResult<FileFormat> {
+    use std::io::Read;
+    let mut file = std::fs::File::open(file_path).map_err(|e| {
+        raise_error!(format!("Failed to open file: {}", e), ErrorCode::InternalError)
+    })?;
+    let mut buf = vec![0u8; 8192];
+    let n = file.read(&mut buf).unwrap_or(0);
+    buf.truncate(n);
+
+    detect_format(&buf, file_name).ok_or_else(|| {
+        raise_error!(
+            "Unknown file format. Supported: .eml, .mbox".into(),
+            ErrorCode::InvalidParameter
+        )
+    })
+}
+
+/// Process a single EML file. The file is at most `MAX_WEB_EML_BYTES` (100 MB),
+/// so reading it entirely is safe.
+fn process_eml_file(
+    import_id: &str,
+    file_path: &Path,
+    account_id: u64,
+    mailbox_id: u64,
+    user_id: u64,
+    folder: &str,
+) {
+    let file_bytes = match std::fs::read(file_path) {
+        Ok(b) => b,
+        Err(e) => {
+            fail_progress(import_id, "eml", &format!("Failed to read file: {}", e), user_id, account_id, folder);
+            let _ = std::fs::remove_file(file_path);
+            return;
+        }
+    };
+
+    let total = 1;
+    update_progress(import_id, ImportProgress {
+        import_id: import_id.to_string(),
+        status: ImportStatus::Processing,
+        format: "eml".to_string(),
+        total,
+        success: 0,
+        duplicates: 0,
+        failed: 0,
+        failed_details: vec![],
+    });
+
+    let (success_count, failed_details) = process_single_eml(&file_bytes, 0, account_id, mailbox_id);
+
+    // Clean up
+    let _ = std::fs::remove_file(file_path);
+
+    let final_progress = ImportProgress {
+        import_id: import_id.to_string(),
+        status: ImportStatus::Completed,
+        format: "eml".to_string(),
+        total,
+        success: success_count,
+        duplicates: 0,
+        failed: failed_details.len(),
+        failed_details,
+    };
+    history::save_import_history(user_id, account_id, folder, &final_progress);
+    update_progress(import_id, final_progress);
+}
+
+/// Process an MBOX file using memory-mapped I/O. Messages are yielded one at a
+/// time by `MboxReader` — the full file is never loaded into RAM.
+fn process_mbox_file(
+    import_id: &str,
+    file_path: &Path,
+    account_id: u64,
+    mailbox_id: u64,
+    user_id: u64,
+    folder: &str,
+) {
+    let mbox = match reader::MboxFile::from_file(file_path) {
+        Ok(m) => m,
+        Err(e) => {
+            fail_progress(import_id, "mbox", &format!("Failed to open MBOX file: {}", e), user_id, account_id, folder);
+            let _ = std::fs::remove_file(file_path);
+            return;
+        }
+    };
+
+    // First pass: count total messages (MboxReader is lazy, so this is O(n) but cheap)
+    let total = mbox.iter().count();
+
+    update_progress(import_id, ImportProgress {
+        import_id: import_id.to_string(),
+        status: ImportStatus::Processing,
+        format: "mbox".to_string(),
+        total,
+        success: 0,
+        duplicates: 0,
+        failed: 0,
+        failed_details: vec![],
+    });
+
+    let mut success_count = 0usize;
+    let mut failed_details: Vec<FailedItemDetail> = Vec::new();
+
+    for (index, entry) in mbox.iter().enumerate() {
+        let eml_bytes = entry.data;
+
+        if eml_bytes.len() > MAX_SINGLE_EML_BYTES {
+            let size_mb = eml_bytes.len() as f64 / 1024.0 / 1024.0;
+            failed_details.push(FailedItemDetail {
+                index,
+                error_message: format!(
+                    "Email at index {} is {:.1} MB (limit {} MB). Skipping.",
+                    index,
+                    size_mb,
+                    MAX_SINGLE_EML_BYTES / 1024 / 1024
+                ),
+            });
+            continue;
+        }
+
+        match futures::executor::block_on(extract_envelope_from_eml(eml_bytes, account_id, mailbox_id)) {
+            Ok(_) => {
+                success_count += 1;
+            }
+            Err(e) => {
+                failed_details.push(FailedItemDetail {
+                    index,
+                    error_message: format!("{:?}", e),
+                });
+            }
+        };
+
+        // Update progress every 100 items
+        if index % 100 == 0 || index == total - 1 {
+            update_progress(import_id, ImportProgress {
+                import_id: import_id.to_string(),
+                status: ImportStatus::Processing,
+                format: "mbox".to_string(),
+                total,
+                success: success_count,
+                duplicates: 0,
+                failed: failed_details.len(),
+                failed_details: failed_details.clone(),
+            });
+        }
+    }
+
+    // Clean up temp file (drop the mmap first — MboxFile owns it)
+    drop(mbox);
+    let _ = std::fs::remove_file(file_path);
+
+    let final_progress = ImportProgress {
+        import_id: import_id.to_string(),
+        status: ImportStatus::Completed,
+        format: "mbox".to_string(),
+        total,
+        success: success_count,
+        duplicates: 0,
+        failed: failed_details.len(),
+        failed_details,
+    };
+    history::save_import_history(user_id, account_id, folder, &final_progress);
+    update_progress(import_id, final_progress);
+}
+
+/// Process a single EML byte slice and return (success_count, failed_details).
+fn process_single_eml(
+    eml_bytes: &[u8],
+    index: usize,
+    account_id: u64,
+    mailbox_id: u64,
+) -> (usize, Vec<FailedItemDetail>) {
+    if eml_bytes.len() > MAX_SINGLE_EML_BYTES {
+        let size_mb = eml_bytes.len() as f64 / 1024.0 / 1024.0;
+        return (0, vec![FailedItemDetail {
+            index,
+            error_message: format!(
+                "Email is {:.1} MB (limit {} MB). Skipping.",
+                size_mb,
+                MAX_SINGLE_EML_BYTES / 1024 / 1024
+            ),
+        }]);
+    }
+
+    match futures::executor::block_on(extract_envelope_from_eml(eml_bytes, account_id, mailbox_id)) {
+        Ok(_) => (1, vec![]),
+        Err(e) => (0, vec![FailedItemDetail {
+            index,
+            error_message: format!("{:?}", e),
+        }]),
+    }
+}
+
+/// Record a fatal failure and save history.
+fn fail_progress(
+    import_id: &str,
+    format: &str,
+    message: &str,
+    user_id: u64,
+    account_id: u64,
+    folder: &str,
+) {
+    let progress = ImportProgress {
+        import_id: import_id.to_string(),
+        status: ImportStatus::Failed,
+        format: format.to_string(),
+        total: 0,
+        success: 0,
+        duplicates: 0,
+        failed: 0,
+        failed_details: vec![FailedItemDetail {
+            index: 0,
+            error_message: message.to_string(),
+        }],
+    };
+    update_progress(import_id, progress.clone());
+    history::save_import_history(user_id, account_id, folder, &progress);
+}

crates/core/src/import/reader.rs

@@ -21,6 +21,8 @@ use std::fs;
 use std::io;
 use std::path::Path;
 
+/// Memory-mapped MBOX file. Messages are yielded one at a time without
+/// loading the entire file into RAM.
 pub struct MboxFile {
     map: Mmap,
 }
@@ -127,10 +129,6 @@ impl<'a> Iterator for MboxReader<'a> {
 
 #[cfg(test)]
 mod tests {
-    use mail_parser::MessageParser;
-
-    use crate::mbox::gmail::determine_folder;
-
     use super::*;
 
     fn collect_entries(data: &[u8]) -> Vec<&[u8]> {
@@ -144,6 +142,7 @@ mod tests {
         let e = collect_entries(data);
         assert_eq!(e, vec![b"mail1\n", b"mail2\n"]);
     }
+
     #[test]
     fn no_trailing_newline() {
         let data = b"From a\nmail1";
@@ -204,22 +203,4 @@ mod tests {
         let e = collect_entries(&data);
         assert_eq!(e.len(), 1000);
     }
-
-    #[test]
-    fn test11() {
-        let mbox = MboxFile::from_file(Path::new("e:\\test.mbox")).unwrap();
-
-        for e in mbox.iter() {
-            let body = e.data;
-
-            let message = MessageParser::new().parse(body).unwrap();
-            let labels = message.header("X-Gmail-Labels").unwrap().as_text().unwrap();
-            //println!("offset={} X-Gmail-Labels={:?}", e.offset, labels);
-            println!(
-                "X-Gmail-Labels={:?}, determine_folder={}",
-                labels,
-                determine_folder(labels)
-            )
-        }
-    }
 }

crates/core/src/settings/cli.rs

@@ -328,6 +328,17 @@ pub struct Settings {
     /// OIDC redirect URI (must match what's registered with the IdP).
     #[clap(long, env, help = "OpenID Connect redirect URI")]
     pub bichon_oidc_redirect_uri: Option<String>,
+
+    /// Maximum HTTP request body size in MB for file uploads (default: 1100 MB).
+    /// Requests exceeding this limit are rejected at the framework level before
+    /// the application reads the body, preventing memory exhaustion attacks.
+    #[clap(
+        long,
+        default_value = "1100",
+        env,
+        help = "Maximum HTTP request body size in MB for file uploads"
+    )]
+    pub bichon_upload_body_limit_mb: u64,
 }
 
 impl Settings {

crates/core/src/settings/mod.rs

@@ -65,6 +65,8 @@ pub struct SystemConfigurations {
     pub bichon_oidc_issuer_url: Option<String>,
     pub bichon_oidc_client_id: Option<String>,
     pub bichon_oidc_redirect_uri: Option<String>,
+
+    pub bichon_upload_body_limit_mb: u64,
 }
 
 impl From<&Settings> for SystemConfigurations {
@@ -103,6 +105,7 @@ impl From<&Settings> for SystemConfigurations {
             bichon_oidc_issuer_url: s.bichon_oidc_issuer_url.clone(),
             bichon_oidc_client_id: s.bichon_oidc_client_id.clone(),
             bichon_oidc_redirect_uri: s.bichon_oidc_redirect_uri.clone(),
+            bichon_upload_body_limit_mb: s.bichon_upload_body_limit_mb,
         }
     }
 }

crates/server/Cargo.toml

@@ -31,6 +31,7 @@ timeago.workspace = true
 chrono.workspace = true
 tracing.workspace = true
 tokio.workspace = true
+futures.workspace = true
 http.workspace = true
 urlencoding.workspace = true
 

crates/server/src/rest/api/import.rs

@@ -16,14 +16,32 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+use std::time::{SystemTime, UNIX_EPOCH};
+
 use crate::common::auth::WrappedContext;
 use crate::rest::api::ApiTags;
 use crate::rest::ApiResult;
-use bichon_core::import::BatchEmlResult;
-use bichon_core::import::{BatchEmlRequest, ImportEmls};
+use bichon_core::account::migration::AccountModel;
+use bichon_core::database::manager::DB_MANAGER;
+use bichon_core::database::MemDbModel;
+use bichon_core::import::{
+    check_temp_disk_space, get_import_progress, process_uploaded_file, update_progress,
+    BatchEmlRequest, BatchEmlResult, ImportEmls, ImportHistory, ImportProgress, ImportStatus,
+    MAX_WEB_EML_BYTES, MAX_WEB_MBOX_BYTES,
+};
+use bichon_core::import::history::{save_import_history, MAX_HISTORY_PER_USER};
+use bichon_core::raise_error;
+use bichon_core::error::code::ErrorCode;
+use bichon_core::settings::dir::DATA_DIR_MANAGER;
 use bichon_core::users::permissions::Permission;
-use poem_openapi::payload::Json;
+use bichon_core::import::detect_text_file;
+use bichon_core::import::FileFormat;
+use futures::StreamExt;
+use poem::Body;
+use poem_openapi::param::{Path, Query};
+use poem_openapi::payload::{Json, Binary};
 use poem_openapi::OpenApi;
+use tokio::io::AsyncWriteExt;
 
 pub struct ImportApi;
 
@@ -44,7 +62,331 @@ impl ImportApi {
         payload: Json<BatchEmlRequest>,
         context: WrappedContext,
     ) -> ApiResult<Json<BatchEmlResult>> {
-        context.require_permission(Some(payload.0.account_id), Permission::DATA_IMPORT_BATCH)?;
-        Ok(Json(ImportEmls::do_import(payload.0).await?))
+        let account_id = payload.0.account_id;
+        let folder = payload.0.mail_folder.clone();
+        context.require_permission(Some(account_id), Permission::DATA_IMPORT_BATCH)?;
+        let result = ImportEmls::do_import(payload.0).await?;
+
+        // Save import history
+        let progress = ImportProgress {
+            import_id: format!(
+                "batch_{:x}",
+                SystemTime::now()
+                    .duration_since(UNIX_EPOCH)
+                    .unwrap_or_default()
+                    .as_nanos()
+            ),
+            status: if result.failed == 0 {
+                ImportStatus::Completed
+            } else if result.success == 0 {
+                ImportStatus::Failed
+            } else {
+                ImportStatus::Completed
+            },
+            format: "eml".to_string(),
+            total: result.total,
+            success: result.success,
+            duplicates: result.duplicates,
+            failed: result.failed,
+            failed_details: result.failed_details.clone(),
+        };
+        save_import_history(context.user.id, account_id, &folder, &progress);
+
+        Ok(Json(result))
+    }
+
+    /// Upload an EML or MBOX file for import into a NoSync account.
+    ///
+    /// The file is sent as the raw request body. Both `account_id` and `mail_folder`
+    /// must be provided as query parameters, along with the original `file_name` for
+    /// extension validation.
+    ///
+    /// Returns an `import_id` to poll for progress via `/import-progress/:import_id`.
+    #[oai(path = "/upload-import", method = "post", operation_id = "upload_import")]
+    async fn upload_import(
+        &self,
+        /// Target account ID (must be NoSync type).
+        account_id: Query<u64>,
+        /// Target mail folder name.
+        mail_folder: Query<String>,
+        /// Original file name, used for extension validation (e.g. "export.eml").
+        file_name: Query<String>,
+        /// The raw file bytes (.eml or .mbox).
+        data: Binary<Body>,
+        context: WrappedContext,
+    ) -> ApiResult<Json<ImportProgress>> {
+        let account_id = account_id.0;
+        context.require_permission(Some(account_id), Permission::DATA_IMPORT_BATCH)?;
+
+        // Basic account validation (fails fast)
+        AccountModel::check_account_exists(account_id)?;
+
+        let folder = mail_folder.0.trim().to_string();
+        if folder.is_empty() {
+            return Err(raise_error!(
+                "mail_folder is required.".into(),
+                ErrorCode::InvalidParameter
+            ))?;
+        }
+
+        let file_name = file_name.0.trim().to_string();
+        if file_name.is_empty() {
+            return Err(raise_error!(
+                "file_name is required.".into(),
+                ErrorCode::InvalidParameter
+            ))?;
+        }
+
+        // Validate file extension
+        let ext_lower = std::path::Path::new(&file_name)
+            .extension()
+            .and_then(|e| e.to_str())
+            .map(|e| e.to_lowercase())
+            .unwrap_or_default();
+        let is_mbox_ext = ext_lower == "mbox";
+        let is_eml_ext = ext_lower == "eml";
+        if !is_mbox_ext && !is_eml_ext {
+            return Err(raise_error!(
+                format!(
+                    "Unsupported file type '.{}'. Only .eml and .mbox files are allowed.",
+                    ext_lower
+                ),
+                ErrorCode::InvalidParameter
+            ))?;
+        }
+
+        // Check disk space (fail fast before streaming)
+        let min_required = if is_mbox_ext { MAX_WEB_MBOX_BYTES } else { MAX_WEB_EML_BYTES };
+        let free = check_temp_disk_space()?;
+        if free < min_required as u64 * 2 {
+            let free_gb = free as f64 / 1024.0 / 1024.0 / 1024.0;
+            let need_gb = (min_required as f64 * 2.0) / 1024.0 / 1024.0 / 1024.0;
+            return Err(raise_error!(
+                format!(
+                    "Insufficient disk space. Free: {:.1} GB. Need at least {:.1} GB.",
+                    free_gb, need_gb
+                ),
+                ErrorCode::InvalidParameter
+            ))?;
+        }
+
+        // Stream body to temp file, enforcing size limits and validating content
+        let import_id = format!(
+            "imp_{:x}",
+            SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap_or_default()
+                .as_nanos()
+        );
+        let temp_path = DATA_DIR_MANAGER.temp_dir.join(format!("import_{}.tmp", import_id));
+
+        let (format_detected, file_len) = stream_body_to_temp(
+            data.0,
+            &temp_path,
+            is_mbox_ext,
+        ).await?;
+
+        let format = format_detected.unwrap_or_else(|| {
+            if is_mbox_ext { FileFormat::Mbox } else { FileFormat::Eml }
+        });
+
+        let format_str = match format {
+            FileFormat::Mbox => "mbox".to_string(),
+            FileFormat::Eml => "eml".to_string(),
+        };
+
+        let max_size = match format {
+            FileFormat::Mbox => MAX_WEB_MBOX_BYTES,
+            FileFormat::Eml => MAX_WEB_EML_BYTES,
+        };
+        if file_len > max_size {
+            let _ = std::fs::remove_file(&temp_path);
+            let max_mb = max_size as f64 / 1024.0 / 1024.0;
+            let actual_mb = file_len as f64 / 1024.0 / 1024.0;
+            return Err(raise_error!(
+                format!(
+                    "File too large ({:.1} MB). Maximum for {} is {:.0} MB. Use the CLI for larger files.",
+                    actual_mb, format_str.to_uppercase(), max_mb
+                ),
+                ErrorCode::InvalidParameter
+            ))?;
+        }
+
+        // Record initial progress
+        let initial = ImportProgress {
+            import_id: import_id.clone(),
+            status: ImportStatus::Pending,
+            format: format_str.clone(),
+            total: 0,
+            success: 0,
+            duplicates: 0,
+            failed: 0,
+            failed_details: vec![],
+        };
+
+        // Store initial progress so polling can find it immediately
+        update_progress(&import_id, initial.clone());
+
+        // Spawn background processing
+        let id = import_id.clone();
+        let folder_clone = folder.clone();
+        let user_id = context.user.id;
+        tokio::task::spawn_blocking(move || {
+            process_uploaded_file(&id, &temp_path, &file_name, account_id, &folder_clone, user_id);
+        });
+
+        Ok(Json(initial))
+    }
+
+    /// Poll import progress by import ID.
+    #[oai(
+        path = "/import-progress/:import_id",
+        method = "get",
+        operation_id = "get_import_progress"
+    )]
+    async fn get_import_progress(
+        &self,
+        import_id: Path<String>,
+        context: WrappedContext,
+    ) -> ApiResult<Json<ImportProgress>> {
+        let _ = context; // progress queries don't need per-account auth
+        match get_import_progress(&import_id.0) {
+            Some(progress) => Ok(Json(progress)),
+            None => Err(raise_error!(
+                format!("Import {} not found.", import_id.0),
+                ErrorCode::ResourceNotFound
+            ))?,
+        }
+    }
+
+    /// Check available disk space on the server's temp directory.
+    #[oai(
+        path = "/check-disk-space",
+        method = "get",
+        operation_id = "check_disk_space"
+    )]
+    async fn check_disk_space(&self, _context: WrappedContext) -> ApiResult<Json<u64>> {
+        let free = check_temp_disk_space()?;
+        Ok(Json(free))
+    }
+
+    /// List import history for the current user (latest first, up to 5 entries).
+    #[oai(
+        path = "/import-history",
+        method = "get",
+        operation_id = "list_import_history"
+    )]
+    async fn list_import_history(
+        &self,
+        context: WrappedContext,
+    ) -> ApiResult<Json<Vec<ImportHistory>>> {
+        let prefix = format!("{}:", context.user.id);
+        let coll = DB_MANAGER.db().collection(ImportHistory::collection());
+        let mut entries: Vec<ImportHistory> = coll
+            .scan_prefix(&prefix)
+            .map_err(|e| raise_error!(format!("{:#?}", e), ErrorCode::InternalError))?;
+        // Sort by created_at descending (newest first), keep at most N per user
+        entries.sort_by(|a, b| b.created_at.cmp(&a.created_at));
+        entries.truncate(MAX_HISTORY_PER_USER);
+        Ok(Json(entries))
     }
 }
+
+/// Stream a poem `Body` to a temp file while enforcing size limits and
+/// validating that the content looks like a text-based email file.
+///
+/// Returns the detected format (if any) and the total bytes written.
+async fn stream_body_to_temp(
+    body: Body,
+    temp_path: &std::path::Path,
+    is_mbox_ext: bool,
+) -> ApiResult<(Option<FileFormat>, usize)> {
+    let max_stream = if is_mbox_ext { MAX_WEB_MBOX_BYTES } else { MAX_WEB_EML_BYTES };
+
+    let mut file = tokio::fs::File::create(temp_path).await.map_err(|e| {
+        raise_error!(
+            format!("Failed to create temp file: {}", e),
+            ErrorCode::InternalError
+        )
+    })?;
+
+    let mut body_stream = body.into_bytes_stream();
+    let mut total: usize = 0;
+    let mut first_chunk: Vec<u8> = Vec::new();
+    let mut format_detected: Option<FileFormat> = None;
+    let mut text_checked = false;
+
+    while let Some(chunk_result) = body_stream.next().await {
+        let chunk = chunk_result.map_err(|e| {
+            raise_error!(
+                format!("Failed to read request body: {}", e),
+                ErrorCode::InternalError
+            )
+        })?;
+
+        total += chunk.len();
+
+        // Enforce size limit during streaming
+        if total > max_stream {
+            // Clean up partial temp file
+            drop(file);
+            let _ = tokio::fs::remove_file(temp_path).await;
+            let max_mb = max_stream as f64 / 1024.0 / 1024.0;
+            return Err(raise_error!(
+                format!(
+                    "Upload exceeds maximum size of {:.0} MB. Use the CLI for larger files.",
+                    max_mb
+                ),
+                ErrorCode::InvalidParameter
+            ))?;
+        }
+
+        // Accumulate first ~8 KB for format & text detection
+        if first_chunk.len() < 8192 {
+            let remaining = 8192 - first_chunk.len();
+            first_chunk.extend_from_slice(&chunk[..chunk.len().min(remaining)]);
+        }
+
+        // Once we have enough data, validate format and text
+        if first_chunk.len() >= 512 && !text_checked {
+            text_checked = true;
+            format_detected = bichon_core::import::detect_format(&first_chunk, "upload");
+
+            // If extension is .eml but content looks like MBOX (or vice versa), that's OK.
+            // But if content doesn't look like either, reject.
+            if !detect_text_file(&first_chunk) {
+                drop(file);
+                let _ = tokio::fs::remove_file(temp_path).await;
+                return Err(raise_error!(
+                    "The uploaded file appears to be binary (not a valid email file). Only .eml and .mbox text files are accepted.".into(),
+                    ErrorCode::InvalidParameter
+                ))?;
+            }
+        }
+
+        file.write_all(&chunk).await.map_err(|e| {
+            raise_error!(
+                format!("Failed to write temp file: {}", e),
+                ErrorCode::InternalError
+            )
+        })?;
+    }
+
+    file.flush().await.map_err(|e| {
+        raise_error!(
+            format!("Failed to flush temp file: {}", e),
+            ErrorCode::InternalError
+        )
+    })?;
+
+    // If file is empty, reject
+    if total == 0 {
+        let _ = tokio::fs::remove_file(temp_path).await;
+        return Err(raise_error!(
+            "Empty file is not allowed.".into(),
+            ErrorCode::InvalidParameter
+        ))?;
+    }
+
+    Ok((format_detected, total))
+}